K7 Antivirus Vulnerability Allows Attackers to Gain SYSTEM-Level Privileges

A critical privilege escalation vulnerability affecting K7 Ultimate Security has been discovered, allowing low-privileged users to escalate their access to SYSTEM-level permissions without triggering User Account Control (UAC) prompts.

Security researcher Lucas Laise from Quarkslab uncovered the vulnerability while investigating an unrelated issue in the K7 antivirus product from K7 Computing.

Vulnerability Overview

The flaw exploits improperly configured named pipes with overly permissive access control lists (ACLs).

Named pipes are inter-process communication mechanisms in Windows that enable applications to share data.

K7 Ultimate Security implemented multiple named pipes including K7MailProxyV1 and K7TSMngrService1, both running with SYSTEM privileges but lacking adequate access restrictions.

This configuration allowed unprivileged processes to impersonate legitimate administrative requests and manipulate critical registry settings without authorization.

Initial testing revealed that K7 administrators could enable a setting called “non-admin users can change settings and disable protection” without triggering UAC prompts.

This setting hinted at underlying inter-process communication vulnerabilities. Researchers used specialized tools like PipeViewer and IoNinja to identify SYSTEM-owned named pipes and capture binary payloads transmitted during configuration changes.

The exploitation vector centered on the K7TSMngrService1 named pipe, which K7TSMain.exe used for registry modifications.

Attackers could replay captured packets via PowerShell to enable universal configuration tampering, effectively disabling real-time scans or whitelisting malicious files.

Further refinement targeted the registry key AdminNonAdminIsValid through byte-length manipulation, allowing arbitrary value injection that evaded validation checks.

For complete privilege escalation, researchers exploited Image File Execution Options (MITRE ATT&CK T1546.012) by setting a debugger on K7TSHlpr.exe to execute arbitrary code as SYSTEM during fake update processes.

This technique enabled attackers to create new admin user accounts with full system access.

K7 issued three patches attempting to address the vulnerability. The first patch added caller validation on K7TSMngrService1, but researchers bypassed it using manual DLL mapping into k7tsmngr.exe.

The second patch, implemented via K7Sentry.sys driver version 22.0.0.70, attempted to block process injection through protected process mechanisms.

However, this was circumvented using renamed signed K7 binaries operating outside protected process lists.

Root-cause analysis revealed that ValidatePipeClient checks installation paths, MD5 hashes, and K7 signatures, but can be bypassed using unsigned or relocated signed binaries.

K7 deferred full ACL enforcement to a future major release, acknowledging the complexity of interim fixes.

Timeline and Disclosure

Responsible disclosure spanned from August to December 2025. Quarkslab notified K7 Computing on August 25, 2025, and published full technical details on December 2, 2025, after confirming that multiple patches could be bypassed.

The vulnerability represents a significant security concern for K7 Ultimate Security users across various organizations.

Users should immediately update to the latest K7 antivirus versions and monitor for comprehensive remediation.

Security professionals can access exploit scripts on the Quarkslab blog for defensive analysis and internal testing purposes.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates